﻿//此程序作用：查看自启动的系统驱动程序
//做法是：访问注册表路径HKLM\SYSTEM\CurrentControlSet\Services中，后缀为.sys的项目

#include <iostream>
#include<windows.h>
#include <tchar.h>  

int main()
{
	HKEY hkeyOuter = NULL;
	const TCHAR *rootMenu = _T("SYSTEM\\CurrentControlSet\\Services\\");

	long openResult = ::RegOpenKeyEx(
		HKEY_LOCAL_MACHINE,
		rootMenu,
		0,
		KEY_READ,
		&hkeyOuter
	);

	if (openResult!=ERROR_SUCCESS)
	{
		printf("No such target\n");
		if (hkeyOuter != NULL) {
			RegCloseKey(hkeyOuter);
		}
		return 1;
	}

	long rest = NULL;
	long key_log = NULL;
	HKEY hkeyInner = NULL;
	TCHAR keyData[MAX_PATH] = _T("");
	TCHAR innerFile[MAX_PATH] = _T("");
	DWORD i = 0;
	DWORD cbMaxSubKey = MAX_PATH;
	DWORD dwType = MAX_PATH;
	DWORD dwSize = MAX_PATH;
	
	int count = 0;
	rest = RegEnumKeyEx(hkeyOuter, i, innerFile, &cbMaxSubKey, NULL, NULL, NULL, NULL);
	//列举HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services下的子键XX并赋值给achKey
	while (rest!=ERROR_NO_MORE_ITEMS)	//循环步数：i++
	{
		//打开子文件夹
		TCHAR ultraPath[MAX_PATH] = _T("");
		wcscat_s(ultraPath, rootMenu);
		wcscat_s(ultraPath, innerFile);
		if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, ultraPath, 0, KEY_READ, &hkeyInner) == ERROR_SUCCESS) {
			key_log = RegQueryValueEx(hkeyInner, _T("ImagePath"), NULL, &dwType, (BYTE *)&keyData, &dwSize);
			
			if (key_log==ERROR_SUCCESS)
			{
				DWORD statusData=0;
				DWORD dwType2 = MAX_PATH;
				DWORD dwSize2 = MAX_PATH;
				//查询启动项优先级
				long forStatus = RegQueryValueEx(hkeyInner, _T("Start"), NULL, &dwType2,(BYTE*)&statusData, &dwSize2);
				if (forStatus==ERROR_SUCCESS && wcsstr(keyData, L".sys") != NULL&&statusData<=2) {
					count++;
					printf("Location: %ws, data: %ws\n", innerFile, (LPCTSTR)keyData);
					printf("Start priority:%u\n",statusData);
				}
			}
			if (hkeyInner != NULL) {
				RegCloseKey(hkeyInner);
			}
			
		}
		ZeroMemory(innerFile, 10);
		cbMaxSubKey = MAX_PATH;
		i++;
		rest = RegEnumKeyEx(hkeyOuter, i, innerFile, &cbMaxSubKey, NULL, NULL, NULL, NULL);
	}


	if (hkeyOuter != NULL) {
		RegCloseKey(hkeyOuter);
		printf("---------------\ntotal count=%d, i am all right",count);
	}
	return 0;
}